PT-2026-47314 · Apache · Apache Http Server

Published 2026-06-08 · Updated 2026-06-08 · CVE-2026-29170

Mitre

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting vulnerability exists in mod proxy ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-29170

Affected Products

Apache Http Server

References · 2

• https://httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29170 · Security Note